R81.20 Gaia Kernel Update?

[Timothy_Hall]

So it would appear that the version of the Gaia kernel was updated in R81.20 to 3.10.0-1160.15.2cpx86_64 from the older 3.10.0-957.21.3cpx86_64 which maps from RHEL 7.6 to RHEL 7.9.  

Were there specific reasons Check Point decided to update the kernel in this release beyond getting the latest package updates (most of which are stripped out by Check Point anyway as part of Gaia hardening), some stronger Gaia ciphers, and support for the latest hardware (storage controllers, NICs, etc)? 

One area of interest in the RHEL release notes: it appears the NIC driver versions for igb/ixgbe/i40/mlx_core have all been updated.  While this is generally a good thing (and I know that NIC drivers are sometimes updated in Jumbo HFAs) this has been an area of concern in the past in regards to performance & stability and sometimes even behavioral changes.  An example of the latter is sudden RX-DRPs appearing when Gaia 3.10 was first deployed due to unknown EtherTypes detailed in sk166424: Number of RX packet drops on interfaces increases on a Security Gateway R80.30 and higher ...

I looked through the RHEL 7.7-7.9 release notes and didn't see any new interesting capabilities or commands directly relevant to how Gaia is used to run Check Point software, does R&D care to share any tips or tricks present in this kernel update?  Tagging @PhoneBoy 

[PhoneBoy]

I suspect the main reasons for updating the Linux kernel are:

• Updated drivers for hardware and NICs for future appliances, newer Open Servers, and virtualization environments (not all of which may be packportable).
• Ability to support newer versions of userspace tools like OpenSSH.
• For future capabilities not yet announced.

Longer term, I suspect we'll see more frequent updates to the Linux kernel included in Gaia.
It probably won't happen with every release, but it will definitely happen more frequently than during the 10+ year stretch where the Linux 2.6 kernel was used.

[Timothy_Hall]

Thanks.  The updating of the Gaia kernel is a relatively rare event, and I was wondering if there were any reasons not part of the standard ones you listed.  Gotta admit I get a little nervous whenever the NIC drivers get touched as there have been some issues introduced in the past such as soft lockups, TCP offloads, improper traffic balancing of multiple queues, Emulex/Broadcom NIC issues, etc.

[PhoneBoy]

None that I'm aware of anyway 🙂

[genisis__]

I hope that when doing upgrades this does not cause an issue.  When I went from R80.30 to R80.40 (I believe that's when kernel 3.10 was introduced) it caused a world of pain and we had to do a clean rebuild.

[_Val_]

A world of pain? Any details?

[genisis__ · Accepted solution]

TAC R&D where involved and had something to do with vlan tagging issues as a result of the kernel change.  This only happened when doing an in-place upgrade and R&D advised to do a clean build which would resolve the issue.

This was a few years back so details are vague now.

[Timothy_Hall]

This most recent update is simply a minor build update within the 3.10 kernel, whereas the prior kernel transition was a huge jump from 2.6.18 to 3.10 along with a major filesystem type change.  The chances of the kernel build update in R81.20 causing some new issues are quite low but never zero, which is why I created this thread.

[the_rock]

I recall customer telling me about this few years ago, but I never had to do clean install due to it. Hope I dont jinx it now lol 🤞